4 ms·
This reminds me my own story: few weeks ago I was trying out their service and on newly created droplet I've noticed a... shell history of downloading and execu
by tachion 13y ago
This reminds me my own story: few weeks ago I was trying out their service and on newly created droplet I've noticed a... shell history of downloading and executing a shell script:
1 clear
2 ls
3 clear
4 wget https://kmlnsr.me/cleanimage.sh
5 rm cleanimage.sh
6 cd /tmp/
7 wget https://kmlnsr.me/cleanimage.sh
8 chmod +x cleanimage.sh
9 ./cleanimage.sh
This looked very disturbing, so I went and check what that script is, and it is available to read for everyone, and seems to be a part of their provisioning procedure for the vm's, written by some guy who works for DigitalOcean as 'Community Organizer' (however, at that point I thought the website might be created by an attacker and misleading).
Not only it looks bad and alarming to customers, but also poses a security threat, where an attacker could target his website and/or server and replace the script with something nasty inside. How long before they'd notice such fact? No idea, but I've opened a ticket about it right on, giving them some advice on why its bad (availability, scaling, performance, security and PR reasons) but also how to better handle it, and it seems nothing has been done about it so far.
That rings a bell in my head not to use Digital Ocean service as things they do are looking pretty amateur.
- coolj 13y agoTo be honest, this looks like an artifact of the base image creation process. "This file is used to clean up traces from DigitalOcean images before being published." I don't think someone actually logged in and ran those commands on your instance. I could be wrong, but I'd bet this is just from sloppy creation of the base image leaving weird stuff in history after the image was published.
- tachion 13y agoI have not said that someone does it manually, I only said, that on first look, that looks really suspicious. And, at the end, the support told me that: "This is Kamal Nasser's script that has been set up to run on the images. The cleanimage.sh script sometimes doesn't clear the history. Thank you for bringing this to our attention. I've brought this to his attention. There is nothing to worry about with this." So in fact, it seems like it is being used, instead of being a leftover in shell history. In addition to that, I was later answered to the same ticket, by different support member that this script is not being used and just sits on that web page, but it all looks really bad in terms of professionalism.
- coolj 13y agoAgreed. I wasn't defending DO's professionalism there, just saying that from my experience creating base images for a (different) cloud provider, it looks like an artifact of image creation rather than a real cause for alarm (I would certainly be alarmed if random people were logging in to my instance and running random scripts from the web!).
- neom 13y agoYah, that's sloppy and won't happen again. Sorry you had that experience.
- quotemstr 13y agoBy the way: that script is meant to be sourced, not execed: the HISTFILE manipulation at the end only works if the script is sourced --- that's why you see this script in your shell history.
- iancarroll 13y agoYeah, I've seen this on my instance as well. If the server was compromised... :\
- odonnellryan 13y agoI had this exact same thing.